The User Frontend plugin by wedevs for WordPress, which handles registration, user profiles, membership, content restriction, user directory, and frontend post submission, suffers from a missing capability check in the 'Frontend_Form_Ajax::submit_post' function. This missing authorization allows unauthenticated attackers to delete attachments, representing an integrity violation. The vulnerability affects all versions up to and including 4.2.4. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but partial integrity impact.

An unauthenticated attacker can delete attachments via the vulnerable function, causing unauthorized data modification. There is no impact on confidentiality or availability. The integrity of user-uploaded content is at risk, potentially disrupting user data or site content relying on these attachments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's frontend submission features if possible, or disable the plugin to prevent exploitation. Monitor for updates from wedevs and apply patches promptly once available.